js逆向实战之某二手平台请求参数加密逻辑

声明：本篇文章仅用于知识分享，不得用于其他用途
网址：https://www.goofish.com/

加密逻辑

1. 随便点击一个模块，看触发的数据包。
   
   再选择一个模块，看哪些参数会变化。
   
   
   比较一下得知t和sign的值会变化。请求数据中的machId是根据所选模块变化的。
2. 主要关注sign的加密逻辑，搜索请求参数中比较独特的一个字段jsv。
   
   总共有4处，在第一处可以看到为jsv、t和sign赋值的语句。
   
3. 打断点，刷新界面。
   
   关键代码两行：

• t=j=(new Date).getTime()：获取时间戳
• sign=k=i(d.token + "&" + j + "&" + h + "&" + c.data):
  涉及i、d.token、j、h、c.data。
  • d.token：控制台输出一下，是个定值。
    
    不放心的话，可以重新刷新界面，看是否会变化。
  • j：时间戳
  • h：控制台输出，是个定值。
    
  • c.data：控制台输出，发现其实是数据包中的请求数据。
    
  • i：加密函数，定位一下，全部抠出来即可。
    

4. 运行一下抠出来的js代码。

   var h = 34839810;
   var j = (new Date).getTime();
   var k = i("a9b974fd6a1d777ca53ee9ac59fab8ed" + "&" + j + "&" + h + "&" + '{"itemId":"","pageSize":30,"pageNumber":1,"machId":"165362_1"}');
   var str = "a9b974fd6a1d777ca53ee9ac59fab8ed" + "&" + j + "&" + h + "&" + '{"itemId":"","pageSize":30,"pageNumber":1,"machId":"165362_1"}';
   console.log(str)
   function i(a) {function b(a, b) {return a << b | a >>> 32 - b}function c(a, b) {var c, d, e, f, g;return e = 2147483648 & a,f = 2147483648 & b,c = 1073741824 & a,d = 1073741824 & b,g = (1073741823 & a) + (1073741823 & b),c & d ? 2147483648 ^ g ^ e ^ f : c | d ? 1073741824 & g ? 3221225472 ^ g ^ e ^ f : 1073741824 ^ g ^ e ^ f : g ^ e ^ f}function d(a, b, c) {return a & b | ~a & c}function e(a, b, c) {return a & c | b & ~c}function f(a, b, c) {return a ^ b ^ c}function g(a, b, c) {return b ^ (a | ~c)}function h(a, e, f, g, h, i, j) {return a = c(a, c(c(d(e, f, g), h), j)),c(b(a, i), e)}function i(a, d, f, g, h, i, j) {return a = c(a, c(c(e(d, f, g), h), j)),c(b(a, i), d)}function j(a, d, e, g, h, i, j) {return a = c(a, c(c(f(d, e, g), h), j)),c(b(a, i), d)}function k(a, d, e, f, h, i, j) {return a = c(a, c(c(g(d, e, f), h), j)),c(b(a, i), d)}function l(a) {for (var b, c = a.length, d = c + 8, e = (d - d % 64) / 64, f = 16 * (e + 1), g = new Array(f - 1), h = 0, i = 0; c > i;)b = (i - i % 4) / 4,h = i % 4 * 8,g[b] = g[b] | a.charCodeAt(i) << h,i++;return b = (i - i % 4) / 4,h = i % 4 * 8,g[b] = g[b] | 128 << h,g[f - 2] = c << 3,g[f - 1] = c >>> 29,g}function m(a) {var b, c, d = "", e = "";for (c = 0; 3 >= c; c++)b = a >>> 8 * c & 255,e = "0" + b.toString(16),d += e.substr(e.length - 2, 2);return d}function n(a) {a = a.replace(/\r\n/g, "\n");for (var b = "", c = 0; c < a.length; c++) {var d = a.charCodeAt(c);128 > d ? b += String.fromCharCode(d) : d > 127 && 2048 > d ? (b += String.fromCharCode(d >> 6 | 192),b += String.fromCharCode(63 & d | 128)) : (b += String.fromCharCode(d >> 12 | 224),b += String.fromCharCode(d >> 6 & 63 | 128),b += String.fromCharCode(63 & d | 128))}return b}var o, p, q, r, s, t, u, v, w, x = [], y = 7, z = 12, A = 17, B = 22, C = 5, D = 9, E = 14, F = 20, G = 4, H = 11,I = 16, J = 23, K = 6, L = 10, M = 15, N = 21;for (a = n(a),x = l(a),t = 1732584193,u = 4023233417,v = 2562383102,w = 271733878,o = 0; o < x.length; o += 16)p = t,q = u,r = v,s = w,t = h(t, u, v, w, x[o + 0], y, 3614090360),w = h(w, t, u, v, x[o + 1], z, 3905402710),v = h(v, w, t, u, x[o + 2], A, 606105819),u = h(u, v, w, t, x[o + 3], B, 3250441966),t = h(t, u, v, w, x[o + 4], y, 4118548399),w = h(w, t, u, v, x[o + 5], z, 1200080426),v = h(v, w, t, u, x[o + 6], A, 2821735955),u = h(u, v, w, t, x[o + 7], B, 4249261313),t = h(t, u, v, w, x[o + 8], y, 1770035416),w = h(w, t, u, v, x[o + 9], z, 2336552879),v = h(v, w, t, u, x[o + 10], A, 4294925233),u = h(u, v, w, t, x[o + 11], B, 2304563134),t = h(t, u, v, w, x[o + 12], y, 1804603682),w = h(w, t, u, v, x[o + 13], z, 4254626195),v = h(v, w, t, u, x[o + 14], A, 2792965006),u = h(u, v, w, t, x[o + 15], B, 1236535329),t = i(t, u, v, w, x[o + 1], C, 4129170786),w = i(w, t, u, v, x[o + 6], D, 3225465664),v = i(v, w, t, u, x[o + 11], E, 643717713),u = i(u, v, w, t, x[o + 0], F, 3921069994),t = i(t, u, v, w, x[o + 5], C, 3593408605),w = i(w, t, u, v, x[o + 10], D, 38016083),v = i(v, w, t, u, x[o + 15], E, 3634488961),u = i(u, v, w, t, x[o + 4], F, 3889429448),t = i(t, u, v, w, x[o + 9], C, 568446438),w = i(w, t, u, v, x[o + 14], D, 3275163606),v = i(v, w, t, u, x[o + 3], E, 4107603335),u = i(u, v, w, t, x[o + 8], F, 1163531501),t = i(t, u, v, w, x[o + 13], C, 2850285829),w = i(w, t, u, v, x[o + 2], D, 4243563512),v = i(v, w, t, u, x[o + 7], E, 1735328473),u = i(u, v, w, t, x[o + 12], F, 2368359562),t = j(t, u, v, w, x[o + 5], G, 4294588738),w = j(w, t, u, v, x[o + 8], H, 2272392833),v = j(v, w, t, u, x[o + 11], I, 1839030562),u = j(u, v, w, t, x[o + 14], J, 4259657740),t = j(t, u, v, w, x[o + 1], G, 2763975236),w = j(w, t, u, v, x[o + 4], H, 1272893353),v = j(v, w, t, u, x[o + 7], I, 4139469664),u = j(u, v, w, t, x[o + 10], J, 3200236656),t = j(t, u, v, w, x[o + 13], G, 681279174),w = j(w, t, u, v, x[o + 0], H, 3936430074),v = j(v, w, t, u, x[o + 3], I, 3572445317),u = j(u, v, w, t, x[o + 6], J, 76029189),t = j(t, u, v, w, x[o + 9], G, 3654602809),w = j(w, t, u, v, x[o + 12], H, 3873151461),v = j(v, w, t, u, x[o + 15], I, 530742520),u = j(u, v, w, t, x[o + 2], J, 3299628645),t = k(t, u, v, w, x[o + 0], K, 4096336452),w = k(w, t, u, v, x[o + 7], L, 1126891415),v = k(v, w, t, u, x[o + 14], M, 2878612391),u = k(u, v, w, t, x[o + 5], N, 4237533241),t = k(t, u, v, w, x[o + 12], K, 1700485571),w = k(w, t, u, v, x[o + 3], L, 2399980690),v = k(v, w, t, u, x[o + 10], M, 4293915773),u = k(u, v, w, t, x[o + 1], N, 2240044497),t = k(t, u, v, w, x[o + 8], K, 1873313359),w = k(w, t, u, v, x[o + 15], L, 4264355552),v = k(v, w, t, u, x[o + 6], M, 2734768916),u = k(u, v, w, t, x[o + 13], N, 1309151649),t = k(t, u, v, w, x[o + 4], K, 4149444226),w = k(w, t, u, v, x[o + 11], L, 3174756917),v = k(v, w, t, u, x[o + 2], M, 718787259),u = k(u, v, w, t, x[o + 9], N, 3951481745),t = c(t, p),u = c(u, q),v = c(v, r),w = c(w, s);var O = m(t) + m(u) + m(v) + m(w);return O.toLowerCase()
   }console.log(k);
   

   运行结果如下：
   
   与控制台输出的结果一致，说明加密逻辑正确。
   
5. 可以编写代码获取数据了。

   from functools import partial  # 锁定参数
   import subprocesssubprocess.Popen = partial(subprocess.Popen, encoding="utf-8")import requests
   import execjs
   import timeh = 34839810
   data = {"data": "{\"itemId\":\"\",\"pageSize\":30,\"pageNumber\":1,\"machId\":\"168395_1\"}"
   }
   timestamp = int(time.time()) * 1000
   need_encrypt_str = "a9b974fd6a1d777ca53ee9ac59fab8ed" + "&" + str(timestamp) + "&" + str(h) + "&" + data["data"]
   # need_encrypt_str = 'a9b974fd6a1d777ca53ee9ac59fab8ed&1732339751920&34839810&{"itemId":"","pageSize":30,' \
   #                    '"pageNumber":1,"machId":"165362_1"}'
   # print(need_encrypt_str)
   file = open("test.js", mode='r')
   exec_js = file.read()
   exec_code = execjs.compile(exec_js)
   res = exec_code.call("i", need_encrypt_str)
   # print(res)url = "https://h5api.m.goofish.com/h5/mtop.taobao.idlehome.home.webpc.feed/1.0/"
   params = {"jsv": "2.7.2", "appKey": "34839810", "t": str(timestamp), "v": "1.0", "type": "originaljson","accountSite": "xianyu", "dataType": "json", "timeout": "20000","api": "mtop.taobao.idlehome.home.webpc.feed", "sessionOption": "AutoLoginOnly", "spm_cnt": "a21ybx.home.0.0","sign": res}
   headers = {"Accept": "application/json","Accept-Encoding": "gzip, deflate, br","Accept-Language": "zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6","Content-Length": "109","Content-Type": "application/x-www-form-urlencoded","Origin": "https://www.goofish.com","Referer": "https://www.goofish.com/",'Sec-Ch-Ua': '"Chromium";v="122", "Not(A:Brand";v="24", "Microsoft Edge";v="122"',"Sec-Ch-Ua-Mobile": "?0",'Sec-Ch-Ua-Platform': '"Windows"',"Sec-Fetch-Dest": "empty","Sec-Fetch-Mode": "cors","Sec-Fetch-Site": "same-site","User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0"
   }
   cookies = {"Cookie": "xxxxxxxxx"
   }
   resp = requests.post(url, data=data, headers=headers, params=params, cookies=cookies)
   print(resp.text)
   

   运行结果如下。
   
   结束！